AWS ENI: the network identity behind your workload
See how an Elastic Network Interface binds VPC addresses, subnet placement, security, routing, service ownership, and scaling limits into one network identity.
One interface, one concrete VPC identity
- Primary IPv4
- 10.20.1.17
- Secondary IPv4
- 10.20.1.18
- IPv6
- 2001:db8:20:1::17
- Security groups
- sg-app · sg-observability
- Source/dest check
- enabled
- MAC
- 02:7b:64:10:20:17
The address and control fields belong to the interface; attachment connects that identity to compute.
Keep this model: An ENI is a subnet-scoped network identity with addresses, security associations, and attachment state.
One ENI can carry several IP addresses
- PRIMARY IPv4
10.20.1.17 - SECONDARY IPv4
10.20.1.18 - SECONDARY IPv4
10.20.1.19 - IPv6
2001:db8:20:1::17
Private IPv4 and IPv6 addresses remain grouped under the same subnet-scoped interface.
Keep this model: One ENI is not limited to one IP address.
Elastic IP keeps the public address stable
198.51.100.24stop / start198.51.100.91203.0.113.42stop / start203.0.113.42The internet gateway maps public IPv4 to the private address on the ENI. The guest uses its private IPv4; an Elastic IP remains stable only while you keep it allocated.
Stop/start is the lifecycle boundary shown here; a reboot does not replace the auto-assigned public IPv4.
Keep this model: Use an Elastic IP when a public IPv4 must stay fixed while the address remains allocated.
An ENI belongs to one subnet and one Availability Zone
Keep this model: You can detach an ENI, but you cannot move it to another subnet or Availability Zone.
One EC2 instance can use more than one ENI
sg-app · app trafficsg-admin · admin trafficBoth ENIs attach in ap-south-1a. The arrows illustrate incoming flows; egress and return traffic still depend on the guest's route and policy configuration.
Each interface keeps the subnet identity and security groups of its own network.
Keep this model: Multiple ENIs let one instance participate in multiple subnets in the same Availability Zone.
Trace the packet from source ENI to destination ENI
flow-42 · TCP/5432Disable a gate to reveal the first blocker. The diagram is ordered by responsibility, not literal internal implementation.
Keep this model: Routes choose the path; subnet NACLs and interface security groups filter traffic at different boundaries.
The primitive stays familiar; ownership and controls change
- Created by
- You
- Attached to
- EC2 instance
- Security groups
- You select them
- Lifecycle
- Detach or delete independently
You can create, attach, detach, modify, and delete this interface within normal EC2 constraints.
Requester-managed interfaces remain observable while the service owns their lifecycle. Change or delete the parent service rather than modifying the interface directly.
Choose a service to see who creates the interface and which controls remain yours.
Keep this model: AWS services reuse VPC interfaces without giving every interface the same lifecycle or ownership.
ECS awsvpc gives each task a VPC identity
Keep this model: Trunking raises task density, but task networking still consumes finite interface and address capacity.
EKS turns interface slots and prefixes into Pod capacity
Security Groups for Pods can use branch interfaces for Pod-level policy.
Keep this model: The VPC CNI consumes ENI address capacity; prefix mode changes how that capacity is allocated.
Concurrency does not mean one ENI per invocation
Keep this model: Lambda Hyperplane ENIs are shared managed connectivity for a subnet-and-security-group combination.
An interface can sit on a routed path
0.0.0.0/0 → eni-inspect-in0.0.0.0/0 → igwThe route tables choose the appliance; the EC2 source/destination check and guest OS decide whether transit traffic can cross it.
Keep this model: A forwarding appliance needs both AWS-side and guest-side forwarding configuration.
Move network identity independently from compute
→
→
Keep this model: A secondary ENI and its private addresses can be reassigned for same-AZ failover patterns.
Networking can stop scaling before compute does
Change the demand to see which finite resource becomes the placement blocker.
Keep this model: Subnet addresses, ENI limits, and address slots or prefixes all participate in workload capacity.
Follow the ENI, then follow the packet
- 01Source identityENI, IP, subnet, AZ, attachment, owner
- 02Route decisionsource subnet route table and next hop
- 03Security gatesSG stateful rules and NACL rules in both directions
- 04Destination identityresolved IP, destination ENI, listener and return path
- 05Observed evidenceVPC Flow Logs, service health, guest routes and counters
VPC Flow Logs record traffic metadata. They do not contain packet payloads or replace a guest capture when that level of evidence is needed.
Keep this model: Start from the source interface and stop at the first missing fact or failed control.
ENI, ENA, and EFA answer different questions
Addresses, subnet, security groups, attachment and observable flows.
Enhanced Networking adapter and driver used by supported EC2 instances.
Low-latency device with OS-bypass capabilities for tightly coupled workloads.
Keep this model: ENI is VPC network identity; ENA and EFA describe networking device or fabric capabilities.
Find the interfaces hiding across a VPC
Keep this model: The ENI is a common VPC primitive; ownership and supported controls still belong to each service.